The seven control families behind an agent governance audit

27 controls, grouped into 7 families with fixed weights summing to 100. Each family exists to prevent one class of failure — here is which one, in the audit's own terms.

Published August 24, 2026 · updated August 24, 2026 · by Julian Joseph, founder

Get an Agent Trust Gap Brief

What are the seven control families in an agent governance audit?

Identity and credentials, authority and permission gates, isolation and blast radius, evidence and auditability, supply chain and integrity, human oversight and recovery, and documented governance — 27 controls total, weighted to sum to 100.

Which family carries the most weight, and why?

Authority & Permission Gates, at 20% of the total score — the heaviest single family, because an agent with no deny-by-default rule, no explicit gate, and no bounded grant can turn one instruction into an unlimited, unattributed action.

Which family carries the least weight?

Documented Governance, at 8% of the total score — not because policy doesn't matter, but because a published SECURITY.md, a pinned model version, and a stated retention rule are checkable, yet don't by themselves stop a live action.

Do these families overlap with the ARB website rubric's own "Governance & Trust" pillar?

No. ARB's governance pillar checks a website — security.txt, linked policies, an AI-access statement, security headers. AGA's Documented Governance family checks an agent's own source tree — SECURITY.md, a pinned model identifier, a stated data-retention rule.

All seven families: what each prevents, and the failure it maps to

Family	Weight	Controls	What it prevents	The failure it maps to
Agent Identity & Credentials	14	3	A credential hard-coded into source, or an agent sharing a human's or a shared root principal.	A reusable credential found in the repo (or a fork of it) lets anyone act as the agent indefinitely, with no way to tell which run did it.
Authority & Permission Gates	20	5	An agent executing a costly or irreversible action nobody explicitly authorized, or reusing a stale approval standing to run again.	No deny-by-default, no single gate, no expiry: one manipulated instruction becomes a standing, unlimited-scope privilege the agent keeps acting on.
Isolation & Blast Radius	16	4	One compromised step reaching the whole host, the whole network, or the metadata endpoint of the cloud it runs on.	Unrestricted egress and no SSRF guard turn a single manipulated fetch into a path to internal services or cloud credentials.
Evidence & Auditability	16	5	An incident nobody can reconstruct, because nothing durable was written down when it happened.	No receipts, no tamper-evidence, no logged refusals: the only account of what the agent did is the agent's own unverifiable claim.
Supply Chain & Integrity	14	4	The code running in production silently drifting from the code that was reviewed.	Unpinned dependencies, no vulnerability scan, and a destructive deploy default mean a bad build can overwrite a good one with nothing to catch it.
Human Oversight & Recovery	12	3	An irreversible action completing with no way to stop it mid-flight and no tested way to undo it after.	No kill switch, no human gate, no rollback path: an ordinary bug becomes a permanent loss.
Documented Governance	8	3	An audit stalling before the technical controls are even reached, because the paperwork a reviewer asks for first doesn't exist.	No SECURITY.md, no pinned model version on record, no stated retention rule — the fastest way to fail an audit's first ten minutes.

Source: FAMILIES dict and each control's own title and fix text in /root/apexclaw-audit/aga.py, introspected directly — no incident, client or named breach is cited; each "failure it maps to" describes the generic technical failure mode the family's own controls are written to catch.

Primary standards cited on this page: OWASP Agentic Top 10, NIST AI RMF, ISO/IEC 42001, EU AI Act.

By Julian Joseph, Founder, ApexClaw. Every figure on this page is recomputed at build time from a named source file and date — see the method notes above. Reviewed against the claims policy: sourced, first-party, or labelled.